Return context error when a retry backoff wait is cancelled

Retrying.Generate returned the earlier provider error (e.g. a 429) when
cancellation or the deadline interrupted the backoff wait, so callers and
the ai_runs record saw rate limiting instead of cancellation. Return the
context error from the interrupted wait instead. Retry counts, backoff and
other error semantics are unchanged.

Maestro task: 79447ef7-e55c-4641-b351-37bc22ffa760

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -159,9 +159,28 @@ automatic** (D-021).
   is always the key the provider sends. Request and response
   bodies are redacted before they are stored: the decrypted API key,
   Authorization and API-key header values, Google Chat webhook URLs and URLs
-  with key-like query parameters are removed, inside JSON strings too.
+  with key-like query parameters are removed, inside JSON strings too; the
+  skill, provider and model columns are redacted the same way. Writing the
+  row is bounded: a run whose work ended in time must write its row before
+  the skill's deadline or it fails with `llm.ErrTimeout` and its row records
+  the timeout; a failed run's row has a further fixed bound, and if even
+  that write fails the run returns the write error with its own and no row
+  is stored. A stored row's status therefore always matches what the caller
+  received.
   `harness.Purge` deletes rows older than `harness.RunRetention` (30 days),
-  clearing the `suggestion_batches` and `week_plans` references first.
+  clearing the `suggestion_batches` and `week_plans` references first. The
+  harness does not call it: the scheduler's daily `ai_runs` purge
+  (Feature 20) must call `harness.Purge` with `now - RunRetention`.
+- **Concurrency guards** (`harness.Guard`, one per process): `harness.Run`
+  takes a scope key, and concurrent runs of one skill with one scope share a
+  single in-flight run and its result, error included (single-flight); runs
+  with different scopes are independent. A semaphore lets at most
+  `harness.DefaultMaxCalls` (2, set by `NewGuard`) LLM calls run at once;
+  waiting for a slot honours the context. Each skill declares a timeout
+  (`harness.DefaultTimeout`, 60 s, unless it needs another) bounding the
+  whole run, slot waits and repair turn included; a run past it fails with
+  `llm.ErrTimeout`. A caller whose context ends gets the context error; the
+  shared run is cancelled, freeing its slot, once no caller waits for it.
 - **Prompt layering** (D-007): each skill version's prompt is a
   `text/template` file embedded from `ai/skills/prompts/`
   (`<skill>.v<version>.tmpl`). The system prompt is always, in order:
@@ -211,7 +230,7 @@ purge are fixed and not configurable.
 | `day_of_reminder` | Daily 16:30 | Tonight's dinner reminder. |
 | `rotation_check` | Daily 09:00 | Asks "Keep it in rotation?" for tried dinners. |
 | `week_rollover` | Monday 00:05 (fixed) | Freezes last week's Supply run into the Supply archive. |
-| `ai_runs` purge | Daily (fixed) | Deletes `ai_runs` rows past 30-day retention. |
+| `ai_runs` purge | Daily (fixed) | Calls `harness.Purge` to delete `ai_runs` rows past 30-day retention (Feature 20). |
 
 Runs are recorded in `schedule_runs` and executed through `jobs`.
 

internal/ai/harness/echo_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"strings"
+	"time"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
 )
@@ -53,3 +54,5 @@ func (echoSkill) PostProcess(out echoOutput) (echoOutput, error) {
 	out.Echo = strings.TrimSpace(out.Echo)
 	return out, nil
 }
+
+func (echoSkill) Timeout() time.Duration { return DefaultTimeout }

internal/ai/harness/guard.go

@@ -0,0 +1,133 @@
+package harness
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
+)
+
+// DefaultMaxCalls is how many LLM calls a Guard lets run at once unless it
+// is built with another limit.
+const DefaultMaxCalls = 2
+
+// DefaultTimeout is the run timeout a skill declares unless it needs
+// another.
+const DefaultTimeout = 60 * time.Second
+
+// Guard bounds the process's runs. Runs of one skill with one scope share a
+// single in-flight execution and its result (single-flight), and at most
+// its limit of LLM calls run at once across every run (the semaphore).
+// Build one with NewGuard and share it between every run of the process.
+type Guard struct {
+	slots chan struct{}
+
+	mu      sync.Mutex
+	flights map[flightKey]*flight
+}
+
+// flightKey identifies the runs that share one execution.
+type flightKey struct {
+	skill string
+	scope string
+}
+
+// flight is one in-flight execution and the callers waiting for it.
+type flight struct {
+	done chan struct{}
+	val  any
+	err  error
+	// waiters counts the callers still waiting; when the last one gives
+	// up, cancel stops the execution.
+	waiters int
+	cancel  context.CancelFunc
+}
+
+// NewGuard returns a Guard that lets maxCalls LLM calls run at once.
+func NewGuard(maxCalls int) (*Guard, error) {
+	if maxCalls < 1 {
+		return nil, fmt.Errorf("harness: guard: max concurrent LLM calls %d is not positive", maxCalls)
+	}
+	return &Guard{slots: make(chan struct{}, maxCalls), flights: map[flightKey]*flight{}}, nil
+}
+
+// do returns the result of fn for key, starting fn unless a call for key is
+// already in flight, in which case it waits for that call's result
+// instead. fn runs on a context that keeps the first caller's values but
+// not its cancellation, so one caller giving up does not fail the others.
+// When ctx is done first, do returns its error; when no caller is left
+// waiting, fn's context is cancelled and do returns only once fn has
+// ended, so the abandoned execution has released its slot by then.
+func (g *Guard) do(ctx context.Context, key flightKey, fn func(context.Context) (any, error)) (any, error) {
+	g.mu.Lock()
+	f, ok := g.flights[key]
+	if !ok {
+		fctx, cancel := context.WithCancel(context.WithoutCancel(ctx))
+		f = &flight{done: make(chan struct{}), cancel: cancel}
+		g.flights[key] = f
+		go func() {
+			defer cancel()
+			f.val, f.err = fn(fctx)
+			g.forget(key, f)
+			close(f.done)
+		}()
+	}
+	f.waiters++
+	g.mu.Unlock()
+
+	select {
+	case <-f.done:
+		return f.val, f.err
+	case <-ctx.Done():
+	}
+	g.mu.Lock()
+	f.waiters--
+	last := f.waiters == 0
+	if last {
+		// No caller may join an execution that is being abandoned.
+		g.forgetLocked(key, f)
+		f.cancel()
+	}
+	g.mu.Unlock()
+	if last {
+		<-f.done
+	}
+	return nil, ctx.Err()
+}
+
+// forget removes f from the in-flight executions if it is still there.
+func (g *Guard) forget(key flightKey, f *flight) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.forgetLocked(key, f)
+}
+
+func (g *Guard) forgetLocked(key flightKey, f *flight) {
+	if g.flights[key] == f {
+		delete(g.flights, key)
+	}
+}
+
+// limited is a Provider whose Generate calls hold one of its Guard's slots.
+type limited struct {
+	llm.Provider
+	slots chan struct{}
+}
+
+// Generate waits for a free slot, or for ctx to be done, then sends req
+// and frees the slot when the call returns.
+func (p limited) Generate(ctx context.Context, req llm.Request) (llm.Response, error) {
+	// A done context never takes a slot, even when one is free.
+	if err := ctx.Err(); err != nil {
+		return llm.Response{}, err
+	}
+	select {
+	case p.slots <- struct{}{}:
+	case <-ctx.Done():
+		return llm.Response{}, ctx.Err()
+	}
+	defer func() { <-p.slots }()
+	return p.Provider.Generate(ctx, req)
+}

internal/ai/harness/guard_test.go

@@ -0,0 +1,421 @@
+package harness
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
+)
+
+// timeoutSkill is echoSkill with its own timeout.
+type timeoutSkill struct {
+	echoSkill
+	timeout time.Duration
+}
+
+func (s timeoutSkill) Timeout() time.Duration { return s.timeout }
+
+// slowSkill is timeoutSkill whose PostProcess succeeds only after its
+// timeout has passed.
+type slowSkill struct {
+	timeoutSkill
+}
+
+func (s slowSkill) PostProcess(out echoOutput) (echoOutput, error) {
+	time.Sleep(3 * s.timeout)
+	return s.timeoutSkill.PostProcess(out)
+}
+
+// slowFailingSkill is timeoutSkill whose PostProcess fails only after its
+// timeout has passed.
+type slowFailingSkill struct {
+	timeoutSkill
+}
+
+func (s slowFailingSkill) PostProcess(echoOutput) (echoOutput, error) {
+	time.Sleep(3 * s.timeout)
+	return echoOutput{}, errors.New("cannot finish")
+}
+
+// blocked is one scripted Generate call that blocks until released.
+type blocked struct {
+	started chan struct{}
+	release chan struct{}
+}
+
+// queueBlocked queues r on f as a call that blocks until released.
+func queueBlocked(f *llm.Fake, r llm.GenerateResult) blocked {
+	b := blocked{started: make(chan struct{}), release: make(chan struct{})}
+	r.Started, r.Release = b.started, b.release
+	f.QueueGenerate(r)
+	return b
+}
+
+// result is what one Run returned.
+type result struct {
+	out echoOutput
+	err error
+}
+
+// goRun starts Run of s with scope on cfg and returns where its result
+// arrives.
+func goRun(ctx context.Context, cfg Config, s Skill[echoInput, echoOutput], scope string) <-chan result {
+	ch := make(chan result, 1)
+	go func() {
+		out, err := Run(ctx, cfg, s, scope, echoInput{Word: "taco"})
+		ch <- result{out, err}
+	}()
+	return ch
+}
+
+// await returns what arrives on ch, failing the test after a second.
+func await[T any](t *testing.T, ch <-chan T, what string) T {
+	t.Helper()
+	select {
+	case v := <-ch:
+		return v
+	case <-time.After(time.Second):
+		t.Fatalf("timed out waiting for %s", what)
+		panic("unreachable")
+	}
+}
+
+// waitStarted waits for b's Generate call to start.
+func waitStarted(t *testing.T, b blocked, what string) {
+	t.Helper()
+	select {
+	case <-b.started:
+	case <-time.After(time.Second):
+		t.Fatalf("timed out waiting for %s to call Generate", what)
+	}
+}
+
+// assertNotStarted checks that b's Generate call has not started after a
+// grace period.
+func assertNotStarted(t *testing.T, b blocked, what string) {
+	t.Helper()
+	select {
+	case <-b.started:
+		t.Fatalf("%s called Generate while no slot was free", what)
+	case <-time.After(50 * time.Millisecond):
+	}
+}
+
+// waitWaiters waits until n callers wait for the run of skill with scope.
+func waitWaiters(t *testing.T, g *Guard, skill, scope string, n int) {
+	t.Helper()
+	deadline := time.Now().Add(time.Second)
+	for {
+		g.mu.Lock()
+		got := 0
+		if f := g.flights[flightKey{skill: skill, scope: scope}]; f != nil {
+			got = f.waiters
+		}
+		g.mu.Unlock()
+		if got == n {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("%d callers wait for %s/%s, want %d", got, skill, scope, n)
+		}
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func TestRunSameScopeSharesOneExecution(t *testing.T) {
+	for name, script := range map[string]llm.GenerateResult{
+		"output": reply(`{"echo":"taco"}`),
+		"error":  {Err: llm.ErrAuth},
+	} {
+		t.Run(name, func(t *testing.T) {
+			var f llm.Fake
+			cfg := testConfig(t, &f)
+			b := queueBlocked(&f, script)
+
+			first := goRun(context.Background(), cfg, echoSkill{}, "week-1")
+			waitStarted(t, b, "the first run")
+			second := goRun(context.Background(), cfg, echoSkill{}, "week-1")
+			waitWaiters(t, cfg.Guard, "echo", "week-1", 2)
+			close(b.release)
+
+			r1, r2 := await(t, first, "the first run"), await(t, second, "the second run")
+			if r1 != r2 {
+				t.Fatalf("results differ: %+v and %+v", r1, r2)
+			}
+			if name == "output" && (r1.err != nil || r1.out.Echo != "taco") {
+				t.Fatalf("result = %+v, want taco", r1)
+			}
+			if name == "error" && !errors.Is(r1.err, llm.ErrAuth) {
+				t.Fatalf("err = %v, want ErrAuth", r1.err)
+			}
+			assertCalls(t, &f, 1)
+			if rows := runRows(t, cfg.Store); len(rows) != 1 {
+				t.Fatalf("%d ai_runs rows, want 1 for the shared run", len(rows))
+			}
+		})
+	}
+}
+
+func TestRunDifferentScopesRunIndependently(t *testing.T) {
+	var f llm.Fake
+	cfg := testConfig(t, &f)
+	b1 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+	b2 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+
+	week1 := goRun(context.Background(), cfg, echoSkill{}, "week-1")
+	week2 := goRun(context.Background(), cfg, echoSkill{}, "week-2")
+	// Both calls are in Generate at once: neither waits for the other.
+	waitStarted(t, b1, "a run")
+	waitStarted(t, b2, "the other run")
+	close(b1.release)
+	close(b2.release)
+
+	for _, ch := range []<-chan result{week1, week2} {
+		if r := await(t, ch, "a run"); r.err != nil || r.out.Echo != "taco" {
+			t.Fatalf("result = %+v", r)
+		}
+	}
+	assertCalls(t, &f, 2)
+}
+
+func TestRunThirdCallWaitsForSlot(t *testing.T) {
+	var f llm.Fake
+	cfg := testConfig(t, &f)
+	b1 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+	b2 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+	b3 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+
+	first := goRun(context.Background(), cfg, echoSkill{}, "week-1")
+	waitStarted(t, b1, "the first run")
+	second := goRun(context.Background(), cfg, echoSkill{}, "week-2")
+	waitStarted(t, b2, "the second run")
+	third := goRun(context.Background(), cfg, echoSkill{}, "week-3")
+	assertNotStarted(t, b3, "the third run")
+	if n := len(f.Requests()); n != 2 {
+		t.Fatalf("Generate called %d times while both slots were taken, want 2", n)
+	}
+
+	close(b1.release)
+	waitStarted(t, b3, "the third run")
+	close(b2.release)
+	close(b3.release)
+	for _, ch := range []<-chan result{first, second, third} {
+		if r := await(t, ch, "a run"); r.err != nil || r.out.Echo != "taco" {
+			t.Fatalf("result = %+v", r)
+		}
+	}
+	assertCalls(t, &f, 3)
+}
+
+func TestRunCancelledContextReleasesSlot(t *testing.T) {
+	var f llm.Fake
+	cfg := testConfig(t, &f)
+	b1 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+	b2 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+	b3 := queueBlocked(&f, reply(`{"echo":"taco"}`))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	first := goRun(ctx, cfg, echoSkill{}, "week-1")
+	waitStarted(t, b1, "the first run")
+	second := goRun(context.Background(), cfg, echoSkill{}, "week-2")
+	waitStarted(t, b2, "the second run")
+	third := goRun(context.Background(), cfg, echoSkill{}, "week-3")
+	assertNotStarted(t, b3, "the third run")
+
+	cancel()
+	if r := await(t, first, "the cancelled run"); !errors.Is(r.err, context.Canceled) {
+		t.Fatalf("cancelled run err = %v, want context.Canceled", r.err)
+	}
+	// The cancelled run's slot goes to the third run; the first call's
+	// release is never closed.
+	waitStarted(t, b3, "the third run")
+	close(b2.release)
+	close(b3.release)
+	for _, ch := range []<-chan result{second, third} {
+		if r := await(t, ch, "a run"); r.err != nil || r.out.Echo != "taco" {
+			t.Fatalf("result = %+v", r)
+		}
+	}
+	assertCalls(t, &f, 3)
+	var statuses []string
+	for _, r := range runRows(t, cfg.Store) {
+		statuses = append(statuses, r.Status)
+	}
+	if strings.Join(statuses, ",") != "provider_error,ok,ok" {
+		t.Fatalf("statuses = %v, want the cancelled run recorded as provider_error", statuses)
+	}
+}
+
+func TestRunCallerGivingUpLeavesSharedRun(t *testing.T) {
+	var f llm.Fake
+	cfg := testConfig(t, &f)
+	b := queueBlocked(&f, reply(`{"echo":"taco"}`))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	leader := goRun(ctx, cfg, echoSkill{}, "week-1")
+	waitStarted(t, b, "the first run")
+	follower := goRun(context.Background(), cfg, echoSkill{}, "week-1")
+	waitWaiters(t, cfg.Guard, "echo", "week-1", 2)
+
+	cancel()
+	if r := await(t, leader, "the cancelled caller"); !errors.Is(r.err, context.Canceled) {
+		t.Fatalf("cancelled caller err = %v, want context.Canceled", r.err)
+	}
+	close(b.release)
+	if r := await(t, follower, "the remaining caller"); r.err != nil || r.out.Echo != "taco" {
+		t.Fatalf("remaining caller = %+v, want the shared run's output", r)
+	}
+	assertCalls(t, &f, 1)
+}
+
+func TestRunTimeout(t *testing.T) {
+	t.Run("in Generate", func(t *testing.T) {
+		var f llm.Fake
+		cfg := testConfig(t, &f)
+		queueBlocked(&f, reply(`{"echo":"taco"}`))
+		_, err := Run(context.Background(), cfg, timeoutSkill{timeout: 20 * time.Millisecond}, "week-1", echoInput{Word: "taco"})
+		if !errors.Is(err, llm.ErrTimeout) {
+			t.Fatalf("err = %v, want ErrTimeout", err)
+		}
+		assertCalls(t, &f, 1)
+		rows := runRows(t, cfg.Store)
+		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) || !strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) {
+			t.Fatalf("rows = %+v, want one provider_error row naming the timeout", rows)
+		}
+	})
+	t.Run("work that succeeds late", func(t *testing.T) {
+		var f llm.Fake
+		cfg := testConfig(t, &f)
+		f.QueueGenerate(reply(`{"echo":"taco"}`))
+		s := slowSkill{timeoutSkill{timeout: 20 * time.Millisecond}}
+		out, err := Run(context.Background(), cfg, s, "week-1", echoInput{Word: "taco"})
+		if !errors.Is(err, llm.ErrTimeout) {
+			t.Fatalf("err = %v, want ErrTimeout", err)
+		}
+		if out != (echoOutput{}) {
+			t.Fatalf("out = %+v, want no output", out)
+		}
+		assertCalls(t, &f, 1)
+		rows := runRows(t, cfg.Store)
+		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) || !strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) {
+			t.Fatalf("rows = %+v, want one provider_error row naming the timeout", rows)
+		}
+	})
+	t.Run("work that fails late", func(t *testing.T) {
+		var f llm.Fake
+		cfg := testConfig(t, &f)
+		f.QueueGenerate(reply(`{"echo":"taco"}`))
+		s := slowFailingSkill{timeoutSkill{timeout: 20 * time.Millisecond}}
+		_, err := Run(context.Background(), cfg, s, "week-1", echoInput{Word: "taco"})
+		if !errors.Is(err, llm.ErrTimeout) || !strings.Contains(err.Error(), "cannot finish") {
+			t.Fatalf("err = %v, want ErrTimeout and the post-process failure", err)
+		}
+		assertCalls(t, &f, 1)
+		// The row records the timeout the caller received, not the
+		// bad_output a post-process failure in time would be, and keeps
+		// the underlying error.
+		rows := runRows(t, cfg.Store)
+		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) ||
+			!strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) || !strings.Contains(rows[0].Error.String, "cannot finish") {
+			t.Fatalf("rows = %+v, want one provider_error row naming the timeout and the post-process failure", rows)
+		}
+	})
+	t.Run("row saved late", func(t *testing.T) {
+		var f llm.Fake
+		cfg := testConfig(t, &f)
+		f.QueueGenerate(reply(`{"echo":"taco"}`))
+		timeout := 100 * time.Millisecond
+		// Holding the store's only writer connection past the deadline
+		// keeps the ok row from being written in time, after the work
+		// itself has ended in time.
+		conn, err := cfg.Store.Writer.Conn(context.Background())
+		if err != nil {
+			t.Fatal(err)
+		}
+		released := time.AfterFunc(3*timeout, func() { conn.Close() })
+		defer released.Stop()
+		out, err := Run(context.Background(), cfg, timeoutSkill{timeout: timeout}, "week-1", echoInput{Word: "taco"})
+		if !errors.Is(err, llm.ErrTimeout) {
+			t.Fatalf("err = %v, want ErrTimeout", err)
+		}
+		if out != (echoOutput{}) {
+			t.Fatalf("out = %+v, want no output", out)
+		}
+		assertCalls(t, &f, 1)
+		// The row records the timeout the caller received, not the ok
+		// outcome the work had.
+		rows := runRows(t, cfg.Store)
+		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) || !strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) {
+			t.Fatalf("rows = %+v, want one provider_error row naming the timeout", rows)
+		}
+	})
+	t.Run("writer blocked", func(t *testing.T) {
+		var f llm.Fake
+		cfg := testConfig(t, &f)
+		f.QueueGenerate(reply(`{"echo":"taco"}`))
+		timeout := 50 * time.Millisecond
+		saveTimeout := runSaveTimeout
+		runSaveTimeout = 100 * time.Millisecond
+		defer func() { runSaveTimeout = saveTimeout }()
+		// The writer stays held until Run has returned, so neither save
+		// can be written.
+		conn, err := cfg.Store.Writer.Conn(context.Background())
+		if err != nil {
+			t.Fatal(err)
+		}
+		started := time.Now()
+		_, err = Run(context.Background(), cfg, timeoutSkill{timeout: timeout}, "week-1", echoInput{Word: "taco"})
+		elapsed := time.Since(started)
+		conn.Close()
+		if !errors.Is(err, llm.ErrTimeout) || !strings.Contains(err.Error(), "record ai_runs row") {
+			t.Fatalf("err = %v, want ErrTimeout and the row write failure", err)
+		}
+		if bound := timeout + runSaveTimeout + time.Second; elapsed > bound {
+			t.Fatalf("Run took %v with the writer blocked, want at most %v", elapsed, bound)
+		}
+		if rows := runRows(t, cfg.Store); len(rows) != 0 {
+			t.Fatalf("rows = %+v, want none", rows)
+		}
+	})
+	t.Run("waiting for a slot", func(t *testing.T) {
+		var f llm.Fake
+		cfg := testConfig(t, &f)
+		cfg.Guard = testGuard(t, 1)
+		b := queueBlocked(&f, reply(`{"echo":"taco"}`))
+		holder := goRun(context.Background(), cfg, echoSkill{}, "week-1")
+		waitStarted(t, b, "the slot holder")
+
+		_, err := Run(context.Background(), cfg, timeoutSkill{timeout: 20 * time.Millisecond}, "week-2", echoInput{Word: "taco"})
+		if !errors.Is(err, llm.ErrTimeout) {
+			t.Fatalf("err = %v, want ErrTimeout", err)
+		}
+		close(b.release)
+		if r := await(t, holder, "the slot holder"); r.err != nil {
+			t.Fatal(r.err)
+		}
+		assertCalls(t, &f, 1)
+	})
+}
+
+func TestRunRefusesBadGuardInput(t *testing.T) {
+	if _, err := NewGuard(0); err == nil {
+		t.Fatal("NewGuard(0) succeeded")
+	}
+	var f llm.Fake
+	cfg := testConfig(t, &f)
+	if _, err := Run(context.Background(), cfg, echoSkill{}, "", echoInput{Word: "taco"}); err == nil || !strings.Contains(err.Error(), "no scope") {
+		t.Fatalf("empty scope err = %v", err)
+	}
+	if _, err := Run(context.Background(), cfg, timeoutSkill{}, "week-1", echoInput{Word: "taco"}); err == nil || !strings.Contains(err.Error(), "not positive") {
+		t.Fatalf("zero timeout err = %v", err)
+	}
+	assertCalls(t, &f, 0)
+	if rows := runRows(t, cfg.Store); len(rows) != 0 {
+		t.Fatalf("refused runs wrote %d ai_runs rows, want none", len(rows))
+	}
+}

internal/ai/harness/harness.go

@@ -5,6 +5,8 @@
 // and on failure sends exactly one repair turn quoting the problems. If the
 // repair fails too the run fails with llm.ErrBadOutput; there is no silent
 // fallback (D-007). Every run is recorded in ai_runs (see Run and Purge).
+// A Guard shares in-flight runs of one skill and scope, bounds concurrent
+// LLM calls, and each run ends at its skill's timeout.
 package harness
 
 import (
@@ -15,6 +17,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
@@ -39,6 +42,10 @@ type Skill[In, Out any] interface {
 	// is validated again; problems found then are repaired like any other.
 	// Its error fails the run without a repair turn.
 	PostProcess(out Out) (Out, error)
+	// Timeout bounds a whole run, waiting for LLM call slots, the repair
+	// turn and writing a successful run's ai_runs row included (see Run). It is DefaultTimeout unless the skill needs
+	// another, and must be positive.
+	Timeout() time.Duration
 }
 
 // NewProvider builds the provider a run sends its requests to from the
@@ -63,6 +70,9 @@ type Config struct {
 	Persona string
 	// Store receives the run's ai_runs row. It must not be nil.
 	Store *store.Store
+	// Guard is the process's Guard, shared by every run. It must not be
+	// nil.
+	Guard *Guard
 }
 
 // validate reports a Config missing what every run needs.
@@ -76,6 +86,8 @@ func (c Config) validate() error {
 		return errors.New("config has no model")
 	case c.Store == nil:
 		return errors.New("config has no store")
+	case c.Guard == nil:
+		return errors.New("config has no guard")
 	}
 	return nil
 }
@@ -103,6 +115,20 @@ func (e *BadOutputError) Unwrap() error { return llm.ErrBadOutput }
 // output. A provider error other than llm.ErrBadOutput is returned
 // unchanged and never repaired.
 //
+// scope names what the run is for, e.g. a week, and must not be empty.
+// While a run of s with scope is in flight on cfg.Guard, another Run of s
+// with the same scope does not start a run of its own: it waits for that
+// run and returns its output or error, whatever its own in and cfg. So a
+// scope must identify the input. Runs with different scopes, or of
+// different skills, run independently. Every Generate call holds one of
+// cfg.Guard's slots while it runs.
+//
+// A run that has not ended within s.Timeout() fails with an error matching
+// llm.ErrTimeout, wrapping the error its work returned if any, and its row
+// records StatusProviderError whatever that work's outcome. When ctx is done first, Run returns ctx.Err(); the run
+// goes on for the callers still waiting for it, and is cancelled when none
+// is left.
+//
 // Every run with a valid Config writes one ai_runs row when it ends,
 // covering both turns, with its RunStatus and the request and response
 // bodies redacted (see redact). A render failure is recorded as
@@ -111,22 +137,91 @@ func (e *BadOutputError) Unwrap() error { return llm.ErrBadOutput }
 // before anything else, and writes no row since the row cannot be
 // written without one. When the row cannot be written the run fails with
 // that error too, even if its output was usable.
-func Run[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], in In) (Out, error) {
+//
+// Writing the row is bounded too. A run whose work ended in time must
+// write its row before s.Timeout() as well; if the store's writer is not
+// free by then, the run fails with llm.ErrTimeout and its row records the
+// timeout instead. The row of a run that failed is written within a
+// further fixed bound (runSaveTimeout); if it cannot be, the run fails with
+// the write error alongside its own, and no row is stored. So Run returns
+// at most that bound after s.Timeout(), and a stored row's status always
+// matches what the caller received.
+func Run[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], scope string, in In) (Out, error) {
 	var zero Out
 	if err := cfg.validate(); err != nil {
 		return zero, fmt.Errorf("harness: skill %s v%d: %w", s.Name(), s.Version(), err)
 	}
-	log := &runLog{start: store.Now()}
-	out, status, err := execute(ctx, cfg, s, in, log)
-	if saveErr := log.save(ctx, cfg, s.Name(), s.Version(), status, err); saveErr != nil {
-		return zero, errors.Join(err, fmt.Errorf("harness: skill %s v%d: record ai_runs row: %w", s.Name(), s.Version(), saveErr))
+	if scope == "" {
+		return zero, fmt.Errorf("harness: skill %s v%d: no scope", s.Name(), s.Version())
 	}
+	timeout := s.Timeout()
+	if timeout <= 0 {
+		return zero, fmt.Errorf("harness: skill %s v%d: timeout %v is not positive", s.Name(), s.Version(), timeout)
+	}
+	val, err := cfg.Guard.do(ctx, flightKey{skill: s.Name(), scope: scope}, func(ctx context.Context) (any, error) {
+		return runOnce(ctx, cfg, s, timeout, in)
+	})
 	if err != nil {
 		return zero, err
 	}
+	out, ok := val.(Out)
+	if !ok {
+		return zero, fmt.Errorf("harness: skill %s v%d: scope %q is shared with a run whose output is %T", s.Name(), s.Version(), scope, val)
+	}
 	return out, nil
 }
 
+// runOnce is one execution of s on in, ended at timeout, with its ai_runs row.
+func runOnce[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], timeout time.Duration, in In) (Out, error) {
+	var zero Out
+	expired := fmt.Errorf("harness: skill %s v%d: %w: no result within %v", s.Name(), s.Version(), llm.ErrTimeout, timeout)
+	deadline := time.Now().Add(timeout)
+	ctx, cancel := context.WithDeadlineCause(ctx, deadline, expired)
+	defer cancel()
+	log := &runLog{id: store.NewID(), start: store.Now()}
+	out, status, err := execute(ctx, cfg, s, in, log)
+	// Work that only ends after the deadline, such as a slow PostProcess,
+	// is a timeout whatever it returned, so its row says provider_error
+	// like the caller's error, which keeps any underlying error. The clock
+	// is checked as well as ctx because ctx's timer may not have fired yet.
+	if context.Cause(ctx) == expired || !time.Now().Before(deadline) {
+		if err == nil {
+			err = expired
+		} else {
+			err = fmt.Errorf("%w: %w", expired, err)
+		}
+		status = StatusProviderError
+	}
+	// The saves ignore the callers' cancellation, so a cancelled run is
+	// recorded too, but each is bounded. Work that ended in time must also
+	// be recorded in time: its row is written within the deadline or not at
+	// all, so a stored ok or repaired row always means the caller got the
+	// output.
+	if err == nil {
+		sctx, cancel := context.WithDeadline(context.WithoutCancel(ctx), deadline)
+		saveErr := log.save(sctx, cfg, s.Name(), s.Version(), status, nil)
+		late := sctx.Err() != nil
+		cancel()
+		if saveErr == nil {
+			return out, nil
+		}
+		if !late {
+			return zero, fmt.Errorf("harness: skill %s v%d: record ai_runs row: %w", s.Name(), s.Version(), saveErr)
+		}
+		// The store's writer was not free before the deadline, so the run
+		// has not ended in time.
+		err, status = expired, StatusProviderError
+	}
+	// A run that failed is recorded within runSaveTimeout; when it cannot
+	// be, the run fails with both errors.
+	sctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), runSaveTimeout)
+	defer cancel()
+	if saveErr := log.save(sctx, cfg, s.Name(), s.Version(), status, err); saveErr != nil {
+		return zero, errors.Join(err, fmt.Errorf("harness: skill %s v%d: record ai_runs row: %w", s.Name(), s.Version(), saveErr))
+	}
+	return zero, err
+}
+
 // execute renders the prompt, builds the provider and sends the turns,
 // recording them in log. It returns the run's status alongside its result.
 func execute[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], in In, log *runLog) (Out, RunStatus, error) {
@@ -139,6 +234,7 @@ func execute[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], in
 	if err != nil {
 		return zero, StatusProviderError, fmt.Errorf("harness: skill %s v%d: provider: %w", s.Name(), s.Version(), err)
 	}
+	provider = limited{Provider: provider, slots: cfg.Guard.slots}
 	schema := s.Schema()
 	temperature := cfg.Settings.Temperature
 	req := llm.Request{

internal/ai/harness/harness_test.go

@@ -23,12 +23,22 @@ func testConfig(t *testing.T, f *llm.Fake) Config {
 		Settings:    llm.Settings{Provider: "anthropic", Model: "claude-test", Temperature: 0.7},
 		NewProvider: func(llm.Settings, string) (llm.Provider, error) { return f, nil },
 		Store:       emptyHousehold(t),
+		Guard:       testGuard(t, DefaultMaxCalls),
 	}
 }
 
+func testGuard(t *testing.T, maxCalls int) *Guard {
+	t.Helper()
+	g, err := NewGuard(maxCalls)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return g
+}
+
 func run(t *testing.T, f *llm.Fake) (echoOutput, error) {
 	t.Helper()
-	return Run(context.Background(), testConfig(t, f), echoSkill{}, echoInput{Word: "taco"})
+	return Run(context.Background(), testConfig(t, f), echoSkill{}, "week-1", echoInput{Word: "taco"})
 }
 
 func assertCalls(t *testing.T, f *llm.Fake, want int) []llm.Request {
@@ -215,7 +225,7 @@ func TestRunProviderErrorOnRepairPassesThrough(t *testing.T) {
 func TestRunRenderError(t *testing.T) {
 	var f llm.Fake
 	cfg := testConfig(t, &f)
-	_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{})
+	_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{})
 	if err == nil || !strings.Contains(err.Error(), "render") {
 		t.Fatalf("err = %v, want a render error", err)
 	}
@@ -235,7 +245,7 @@ func TestRunProviderBuildError(t *testing.T) {
 	var f llm.Fake
 	cfg := testConfig(t, &f)
 	cfg.NewProvider = func(llm.Settings, string) (llm.Provider, error) { return nil, llm.ErrMissingKey }
-	_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
+	_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
 	if !errors.Is(err, llm.ErrMissingKey) {
 		t.Fatalf("err = %v, want ErrMissingKey", err)
 	}
@@ -254,11 +264,12 @@ func TestRunConfigError(t *testing.T) {
 		"provider name":        func(c *Config) { c.Settings.Provider = "" },
 		"model":                func(c *Config) { c.Settings.Model = "" },
 		"store":                func(c *Config) { c.Store = nil },
+		"guard":                func(c *Config) { c.Guard = nil },
 	} {
 		t.Run(name, func(t *testing.T) {
 			cfg := full
 			edit(&cfg)
-			_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
+			_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
 			if err == nil || !strings.Contains(err.Error(), "config has no "+name) {
 				t.Fatalf("err = %v, want missing %s", err, name)
 			}

internal/ai/harness/prompt_test.go

@@ -119,7 +119,7 @@ func TestRunSendsLayeredPrompt(t *testing.T) {
 	in := echoInput{Word: "Taco", Context: tacoContext}
 	cfg := testConfig(t, &f)
 	cfg.Persona = persona
-	if _, err := Run(context.Background(), cfg, echoSkill{}, in); err != nil {
+	if _, err := Run(context.Background(), cfg, echoSkill{}, "week-1", in); err != nil {
 		t.Fatal(err)
 	}
 	req := assertCalls(t, &f, 1)[0]

internal/ai/harness/runs.go

@@ -38,9 +38,17 @@ const (
 // Purge with time.Now().Add(-RunRetention).
 const RunRetention = 30 * 24 * time.Hour
 
+// runSaveTimeout bounds writing the ai_runs row of a run that has failed,
+// timed out or been cancelled, so a blocked writer cannot hold Run up
+// indefinitely. A variable so tests can shorten it.
+var runSaveTimeout = 5 * time.Second
+
 // Purge deletes the ai_runs rows created before olderThan and returns how
 // many it deleted. The suggestion_batches and week_plans references to
 // those rows are cleared first, in the same transaction.
+//
+// Nothing in this package calls Purge: the scheduler's daily ai_runs purge
+// (Feature 20) must call it with time.Now().Add(-RunRetention).
 func Purge(ctx context.Context, st *store.Store, olderThan time.Time) (int64, error) {
 	if olderThan.IsZero() {
 		return 0, errors.New("harness: purge ai_runs: zero cutoff")
@@ -67,6 +75,9 @@ func Purge(ctx context.Context, st *store.Store, olderThan time.Time) (int64, er
 
 // runLog collects one run's turns for its ai_runs row.
 type runLog struct {
+	// id is the row's ID, fixed for the run so that a second save attempt
+	// can never add a second row.
+	id        string
 	start     store.Timestamp
 	requests  []loggedRequest
 	responses []loggedResponse
@@ -138,8 +149,8 @@ func (l *runLog) add(apiKey string, req llm.Request, resp llm.Response, err erro
 	l.tokensOut += int64(resp.Usage.OutputTokens)
 }
 
-// save writes the run's ai_runs row. It is written even when ctx is done,
-// so a cancelled run is recorded too.
+// save writes the run's ai_runs row within ctx, which the caller bounds.
+// Every stored string is redacted.
 func (l *runLog) save(ctx context.Context, cfg Config, skill string, version int, status RunStatus, runErr error) error {
 	// A run that failed before its first turn stores an empty list.
 	request, err := marshalRedacted(nonNil(l.requests), cfg.APIKey)
@@ -158,12 +169,12 @@ func (l *runLog) save(ctx context.Context, cfg Config, skill string, version int
 		errText = sql.NullString{String: redact("first reply: "+strings.Join(l.problems, "; "), cfg.APIKey), Valid: true}
 	}
 	now := store.Now()
-	return db.New(cfg.Store.Writer).CreateAIRun(context.WithoutCancel(ctx), db.CreateAIRunParams{
-		ID:               store.NewID(),
-		Skill:            skill,
+	return db.New(cfg.Store.Writer).CreateAIRun(ctx, db.CreateAIRunParams{
+		ID:               l.id,
+		Skill:            redact(skill, cfg.APIKey),
 		SkillVersion:     strconv.Itoa(version),
-		Provider:         cfg.Settings.Provider,
-		Model:            cfg.Settings.Model,
+		Provider:         redact(cfg.Settings.Provider, cfg.APIKey),
+		Model:            redact(cfg.Settings.Model, cfg.APIKey),
 		Temperature:      cfg.Settings.Temperature,
 		Status:           string(status),
 		LatencyMs:        sql.NullInt64{Int64: now.Sub(l.start.Time).Milliseconds(), Valid: true},

internal/ai/harness/runs_test.go

@@ -128,7 +128,7 @@ func TestRunWritesOneRowWithStatus(t *testing.T) {
 			f.QueueGenerate(tc.script...)
 			cfg := testConfig(t, &f)
 			before := store.Now()
-			_, runErr := Run(context.Background(), cfg, tc.skill, echoInput{Word: "taco"})
+			_, runErr := Run(context.Background(), cfg, tc.skill, "week-1", echoInput{Word: "taco"})
 			if (runErr == nil) != (tc.status == StatusOK || tc.status == StatusRepaired) {
 				t.Fatalf("Run err = %v for status %s", runErr, tc.status)
 			}
@@ -186,7 +186,7 @@ func TestRunRowPerRun(t *testing.T) {
 	cfg := testConfig(t, &f)
 	f.QueueGenerate(reply(`{"echo":"taco"}`), reply(`{"echo":"TACO"}`), reply(`{"echo":"taco"}`), llm.GenerateResult{Err: llm.ErrAuth})
 	for range 3 {
-		_, _ = Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
+		_, _ = Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
 	}
 	assertCalls(t, &f, 4)
 	var got []string
@@ -204,7 +204,7 @@ func TestRunRecordsCancelledRun(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 	f.QueueGenerate(llm.GenerateResult{Err: context.Canceled})
-	if _, err := Run(ctx, cfg, echoSkill{}, echoInput{Word: "taco"}); !errors.Is(err, context.Canceled) {
+	if _, err := Run(ctx, cfg, echoSkill{}, "week-1", echoInput{Word: "taco"}); !errors.Is(err, context.Canceled) {
 		t.Fatalf("err = %v, want context.Canceled", err)
 	}
 	if rows := runRows(t, cfg.Store); len(rows) != 1 || rows[0].Status != string(StatusProviderError) {
@@ -217,7 +217,7 @@ func TestRunFailsWhenRowCannotBeWritten(t *testing.T) {
 	cfg := testConfig(t, &f)
 	cfg.Settings.Provider = "gemini" // refused by the provider CHECK
 	f.QueueGenerate(reply(`{"echo":"taco"}`))
-	_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
+	_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
 	if err == nil || !strings.Contains(err.Error(), "record ai_runs row") {
 		t.Fatalf("err = %v, want the row write failure", err)
 	}
@@ -276,7 +276,10 @@ func TestRunRowsHoldNoSecrets(t *testing.T) {
 				return &f, nil
 			}
 			cfg.Persona = "Our kitchen. " + leaky
-			_, _ = Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "tacos " + seededWebhook})
+			// A model value can hold a credential too: every stored
+			// column is redacted, not only the bodies.
+			cfg.Settings.Model = "model-" + seededKey + " " + seededWebhook
+			_, _ = Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "tacos " + seededWebhook})
 			assertCalls(t, &f, len(script))
 
 			rows := runRows(t, cfg.Store)
@@ -289,6 +292,9 @@ func TestRunRowsHoldNoSecrets(t *testing.T) {
 					t.Errorf("stored row holds %q:\n%s", s, text)
 				}
 			}
+			if want := "model-" + redactionMarker + " " + redactionMarker; rows[0].Model != want {
+				t.Errorf("stored model = %q, want %q", rows[0].Model, want)
+			}
 			for _, kept := range []string{"Our kitchen.", "Repeat: tacos", redactionMarker} {
 				if !strings.Contains(text, kept) {
 					t.Errorf("stored row lacks %q:\n%s", kept, text)
@@ -334,8 +340,9 @@ func TestRunRowsHoldNoProviderKey(t *testing.T) {
 		APIKey:      seededKey,
 		NewProvider: presets.FromSettings,
 		Store:       emptyHousehold(t),
+		Guard:       testGuard(t, DefaultMaxCalls),
 	}
-	out, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
+	out, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
 	if err != nil {
 		t.Fatal(err)
 	}

internal/ai/llm/fake.go

@@ -11,7 +11,9 @@ import (
 // Fake is a scripted Provider for tests. Each method returns its queued
 // results in order, one per call, and records every Request Generate
 // receives. A call with nothing left in its queue fails, so an unexpected
-// call is never silently answered. It is safe for concurrent use.
+// call is never silently answered. A Generate result can block until the
+// test releases it, so tests can hold calls in flight. It is safe for
+// concurrent use.
 type Fake struct {
 	mu       sync.Mutex
 	generate []GenerateResult
@@ -26,6 +28,13 @@ var _ Provider = (*Fake)(nil)
 type GenerateResult struct {
 	Response Response
 	Err      error
+	// Started, when set, is closed once the call has taken this result and
+	// recorded its Request, before it blocks on Release.
+	Started chan struct{}
+	// Release, when set, makes the call block until it is closed. When
+	// the call's context is done first, the call returns ctx.Err() instead
+	// of Response and Err, as a real provider does.
+	Release <-chan struct{}
 }
 
 // ListModelsResult is one scripted ListModels outcome.
@@ -55,16 +64,29 @@ func (f *Fake) QueueVerify(results ...error) {
 	f.verify = append(f.verify, results...)
 }
 
-// Generate records req and returns the next scripted result.
-func (f *Fake) Generate(_ context.Context, req Request) (Response, error) {
+// Generate records req and returns the next scripted result, blocking
+// first when the result has a Release channel.
+func (f *Fake) Generate(ctx context.Context, req Request) (Response, error) {
 	f.mu.Lock()
-	defer f.mu.Unlock()
 	f.requests = append(f.requests, cloneRequest(req))
 	if len(f.generate) == 0 {
-		return Response{}, fmt.Errorf("llm: fake: unscripted Generate call %d", len(f.requests))
+		n := len(f.requests)
+		f.mu.Unlock()
+		return Response{}, fmt.Errorf("llm: fake: unscripted Generate call %d", n)
 	}
 	r := f.generate[0]
 	f.generate = f.generate[1:]
+	f.mu.Unlock()
+	if r.Started != nil {
+		close(r.Started)
+	}
+	if r.Release != nil {
+		select {
+		case <-r.Release:
+		case <-ctx.Done():
+			return Response{}, ctx.Err()
+		}
+	}
 	return r.Response, r.Err
 }
 

internal/ai/llm/fake_test.go

@@ -136,3 +136,37 @@ func TestFakeConcurrentUse(t *testing.T) {
 		t.Fatalf("%d Generate results unused", g)
 	}
 }
+
+func TestFakeGenerateBlocksUntilReleased(t *testing.T) {
+	var f Fake
+	started, release := make(chan struct{}), make(chan struct{})
+	f.QueueGenerate(GenerateResult{Response: Response{Text: "done"}, Started: started, Release: release})
+	got := make(chan string)
+	go func() {
+		resp, err := f.Generate(context.Background(), Request{})
+		if err != nil {
+			t.Error(err)
+		}
+		got <- resp.Text
+	}()
+	<-started
+	select {
+	case text := <-got:
+		t.Fatalf("Generate returned %q before release", text)
+	case <-time.After(20 * time.Millisecond):
+	}
+	close(release)
+	if text := <-got; text != "done" {
+		t.Fatalf("Generate = %q, want the scripted reply", text)
+	}
+}
+
+func TestFakeBlockedGenerateHonoursContext(t *testing.T) {
+	var f Fake
+	f.QueueGenerate(GenerateResult{Response: Response{Text: "never"}, Release: make(chan struct{})})
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+	defer cancel()
+	if _, err := f.Generate(ctx, Request{}); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("err = %v, want context.DeadlineExceeded", err)
+	}
+}

internal/ai/llm/retry.go

@@ -30,7 +30,8 @@ const (
 // rate limit that names no wait, waits a jittered exponential backoff. The Request's Timeout, or DefaultTimeout, is one
 // deadline for the whole call, retries and waits included; a caller's
 // earlier context deadline wins. A retry whose wait would not end before
-// that deadline is not made: the last error is returned at once.
+// that deadline is not made: the last error is returned at once. A wait
+// cut short by cancellation or the deadline returns the context's error.
 // ListModels and Verify pass straight through.
 type Retrying struct {
 	Provider
@@ -83,8 +84,8 @@ func (r *Retrying) Generate(ctx context.Context, req Request) (Response, error)
 		if !r.now().Add(wait).Before(deadline) {
 			return resp, err
 		}
-		if serr := r.sleep(ctx, wait); serr != nil {
-			return resp, err
+		if err := r.sleep(ctx, wait); err != nil {
+			return Response{}, err
 		}
 	}
 }

internal/ai/llm/retry_test.go

@@ -240,6 +240,43 @@ func TestRetryingStopsWhenContextDone(t *testing.T) {
 	assertConsumed(t, f, 1)
 }
 
+func TestRetryingWaitInterruptedReturnsContextError(t *testing.T) {
+	t.Run("cancelled", func(t *testing.T) {
+		r, f, _ := newTestRetrying()
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		r.sleep = func(ctx context.Context, d time.Duration) error {
+			cancel()
+			return sleep(ctx, d)
+		}
+		f.QueueGenerate(fail(NewRateLimitedError(3*time.Second, "")))
+
+		_, err := r.Generate(ctx, retryReq)
+		if !errors.Is(err, context.Canceled) || errors.Is(err, ErrRateLimited) {
+			t.Fatalf("err = %v, want context.Canceled", err)
+		}
+		assertConsumed(t, f, 1)
+	})
+	t.Run("deadline", func(t *testing.T) {
+		r, f, _ := newTestRetrying()
+		// The fake clock stands still, so the 500ms backoff fits before
+		// the caller's deadline; the real wait outlasts it.
+		r.jitter = func(time.Duration) time.Duration { return 0 }
+		r.sleep = func(ctx context.Context, _ time.Duration) error {
+			return sleep(ctx, time.Hour)
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 600*time.Millisecond)
+		defer cancel()
+		f.QueueGenerate(fail(NewRateLimitedError(0, "")))
+
+		_, err := r.Generate(ctx, retryReq)
+		if !errors.Is(err, context.DeadlineExceeded) || errors.Is(err, ErrRateLimited) {
+			t.Fatalf("err = %v, want context.DeadlineExceeded", err)
+		}
+		assertConsumed(t, f, 1)
+	})
+}
+
 // slowProvider is a Provider whose every attempt takes d on clock c,
 // records the deadline of the context it received, and times out.
 type slowProvider struct {